The Agent Trust Boundary
Identity, permissions, and blast radius for software that acts on its own
An agent is a new principal in your system rather than a feature of your application, so its security comes from where you draw its boundary and never from prompt hygiene.
Assume the injection succeeds. That single assumption reorganises the whole problem: security stops being a matter of instruction wording and becomes a question of identity, authority and containment. This book draws the boundary — who the agent is, what it may call, where its code runs, what it may reach, what it may remember — and places enforcement outside the model, at the gateway, the tool or the destination system. It ends with the evidence an auditor asks for, because from 2 August 2026 some teams have to produce it.
Written for: Architects and security-minded leads giving an agent real credentials for the first time.
No chapter is published yet. The full contents below is the finished outline; chapters go live as they are written, and none of them will sit behind a signup.
What it makes operable
Outcomes, not topic coverage.
- 01Map the trust boundaries of an agentic system and name every principal inside it
- 02Give each production agent one identity and enforce its authority outside the model
- 03Choose an execution sandbox that matches code nobody has reviewed
- 04Produce the logging, oversight and documentation evidence an auditor asks for
Complete contents
12 chapters, in order.
Each chapter settles one decision, so it can be read on its own. Read in sequence to build the argument the book is making.
- 01In writing
The Agent Is a Principal, Not a Feature
What changes the moment software starts acting under an identity of its own.
- 02In writing
Mapping Trust Boundaries in an Agentic System
Drawing the lines between model, tools, data sources, other agents and people.
- 03In writing
Indirect Prompt Injection as the Default Condition
Designing on the assumption that the injection lands.
- 04In writing
Least Privilege at the Tool Layer
Capability reduction per data source, enforced by the tool rather than the prompt.
- 05In writing
One Identity per Agent
Workload identity, short-lived credentials, and an explicit authority record.
- 06In writing
Authorization Enforced Outside the Model
Moving the decision to the gateway or the destination system.
- 07In writing
Running Code Nobody Reviewed
Matching isolation — hardened container, gVisor, microVM — to the threat model.
- 08In writing
Egress Control and Data Exfiltration
Deterministic network blocks as the last defence that still works.
- 09In writing
Memory and Context Poisoning
Quarantining what an agent is allowed to believe about its own past.
- 10In writing
Inter-Agent Communication and Cascading Failure
Signed identity across a boundary, and containment when one agent is wrong.
- 11In writing
Supply Chain: Models, Prompts, Servers, Skills
Inventory and provenance for everything an agent loads at runtime.
- 12In writing
Evidence for Auditors: Logging, Oversight, Documentation
Tamper-evident logs, a stop control that works, and docs generated from the repo.
Evidence
What this book is arguing against.
Third-party sources behind the book's premise. Every figure in them belongs to the party that published it and is attributed to them in the text.
- 2025 Top 10 Risk & Mitigations for LLMs and Gen AI Apps
OWASP Gen AI Security Project · 2025-03-12 · Standard · verified
- OWASP Top 10 for Agentic Applications 2026 Explained
Cycode · 2026-07-21 · Industry report · reported
- How to Sandbox AI Agents in 2026: MicroVMs, gVisor & Isolation Strategies
Northflank · 2026-02-02 · Vendor engineering · reported
- The Non-Human Identity Governance Vacuum
Cloud Security Alliance · 2026-05-20 · Industry report · reported
- EU AI Act High-Risk Compliance: A Technical Readiness Guide for August 2026
McKenna Consultants · 2026-02-24 · Industry report · reported
Continue through the library
Adjacent operating manuals.
AI-Native Product Architecture
Most AI features fail for reasons that have nothing to do with the model. They fail because nobody decided whether the system suggests, drafts or acts, and so nobody designed the undo, the abstention, the escalation or the cost ceiling that each of those shapes implies. This book makes the interaction shape the first decision and derives the rest from it: reversibility, confidence display, routing, unit economics, latency budgets, caching that cannot serve a wrong answer faster, and the evidence that tells you to cut the feature.
Read the full book
Shipping With Agents
Merge rate goes up, cycle time does not move, and everyone blames the tooling. The tooling is fine; the operating model is not. This book redesigns the functions that authorship used to absorb: what a specification has to contain now, how to triage review by risk, what PR size and queue discipline actually buy, who owns code nobody typed, how tests become the contract with the agent, and which delivery metrics still mean anything once most committed code is machine-written.
Read the full book